Windows Defender exclusions.. there are 1000s of articles and official outdated documentation from both Citrix & Microsoft. Furthermore, I feel like these documentations are missing a vital point, what are we applying the exclusions TO? Here is an example, VDAs, DDCs, PVS and more is mentioned but what administrators did in the environment that I am helping them with is that they configured these exclusions and applied them to the VDAs. This is what is confusing.. why do administrators apply exclusions which are ment for DDCs and PVS to the VDA OU? The way I understand it is that each and every component has its own defender exclusions and they should be applied to the OUs where these servers reside. For example, if DDCs reside under CITRIX/Citrix infrastructure then the defender exclusions for DDCs should apply to that OU. If the PVS reside under CITRIX/Citrix infrastructure/PVS then the defender exclusions for PVS should be applied to the PVS OU, not the VDA. Can someone confirm that this is the case? community.citrix.com/tech-zone/build/tech-papers/antivirus-best-practices

I have only ever configured the VDA exclusions against VDAs, PVS against PVS, etc. You're not hurting anything by blanket applying all to all, but that's a bit lazy, IMO. Or if you have CrowdStrike, you can let that team tell you that no exclusions are needed...

Thanks for the confirmation Nick. I only see exclusions against VDAs, there are no exclusions against PVS, DDC etc. Feels like a miss since the day when the environments were created.

I am still a big fan of Defender. Especially for non-persistent. Smallest impact I have seen on any AV. With built-in network offload, definition update, and not scanning unchanged files. I still use this scripted process. docs.jeffriechers.com/Microsoft/vdi-defender-offloading

I see exclusions for PVS, etc. on that page? Nothing for DDCs, but I assume the Cloud Connector section may apply there.

Jeff, does that Defender offloading script also apply to non persistent VDAs?

This was my old build doc

Thanks Nick, would this also be used for VDAs? or is that completely different

Yep, was used for VDAs

multi-session aswell right

We had switched from Trend Micro Apex One to Defender.

I will take a look at these and create something. Thanks!

I have 2 scripts up there. 1 for persistent machines so they all can pull from the file server. 1 for non-persistent where the machines basically mount the definitions over the network.

Not sure how the link in my Google drive changed, but the script mentioned in step 4b is here: drive.google.com/file/d/…/view?usp=sharing

thanks guys